Flux Player Local File Include and Arbitrary File Upload Vulnerabilities

Bugtraq ID:	61326
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 18 2013 12:00AM
Updated:	Jul 18 2013 12:00AM
Credit:	Benjamin Kunz Mejri
Vulnerable:
Not Vulnerable:

Flux Player Local File Include and Arbitrary File Upload Vulnerabilities

Flux Player is prone to local file-include and arbitrary file-upload vulnerabilities because it fails to adequately validate files before uploading them.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.

Flux Player 3.1.0 is vulnerable; other versions may also be affected.

Flux Player Local File Include and Arbitrary File Upload Vulnerabilities

An attacker can exploit these issues using a web browser.

Flux Player Local File Include and Arbitrary File Upload Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Flux Player Local File Include and Arbitrary File Upload Vulnerabilities

References: